A password manager would need to be able to sign events. I mean this plugin does not just login. With every interaction it will get active to sign your messages.

Depends on the mechanic. When there is just no access at all to the nsec, it is probably secure without password. Or you can see the nsec within the plugin?